What it means
Strong provenance connects source, dependencies, build environment, process, and output so consumers can verify that delivered software followed an expected path.
Why it matters
Signatures without trustworthy build evidence can authenticate a compromised artifact, while provenance without verification can be forged or ignored.
Practical focus
- Protect signing identities and use short-lived credentials
- Record reproducible build inputs and environment
- Verify signatures and policy before deployment
- Revoke trust and respond when build systems are compromised
Common mistakes
- Signing on the same untrusted worker that builds code
- Checking signatures without validating identity or policy
- Leaving private keys in pipeline variables
- Generating provenance that consumers never verify
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: